Ttl · XB Field Notes

DNS TTL trades repeated upstream queries against retained answers

Wed, 01 Mar 2028 00:00:00 +0000

A DNS TTL is a lifetime attached to cached data, not a refresh job scheduled for every second. A cache can reuse a valid answer while it retains that entry. After expiry, a subsequent request usually requires fresh resolution unless another configured behavior applies. An idle record need not produce an upstream query merely because its TTL has reached zero.

When it breaks

Shortening TTL increases potential upstream work when clients keep asking for the same data. It does not multiply all authoritative traffic by one universal factor: query frequency, resolver sharing, cache capacity, prefetching, and record diversity affect the result. A short TTL on one popular name behaves differently from a large stream of names that are each queried only once.

A long TTL permits continued use of an answer after the authority changes its data. That cached answer may still be valid under the lifetime originally received even though it no longer matches the newest zone content. Calling every mismatch an expired or broken cache obscures the actual contract. TTL expresses permitted retention; it does not promise continuous synchronization with the authority.

Multiple forwarding layers do not ordinarily receive a fresh copy of the original TTL at every hop. A cache returns remaining lifetime, which the next cache then ages. Adding full TTLs per layer invents a propagation delay that ordinary compliant forwarding does not create. Local TTL overrides and serve-stale policies are separate behaviors that should be identified explicitly when present.

Check it quickly

Save this as check-ttl-cost.py and run python3 check-ttl-cost.py with Docker. The pinned container uses BIND 9.18.49 and dnsmasq 2.90, with no external runtime network. The authoritative server logs actual queries. One forwarder initially serves two names, and the script later starts a second forwarder behind the first to inspect the TTL handed downstream:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
with lab('short 1 IN A 127.0.0.2\nlong 20 IN A 127.0.0.3\nchain 6 IN A 127.0.0.4') as (_,update,cache,queries):
 cache();samples=[]
 for i in range(3):
 pair={name:show(query(name+'.lab.test.',port=1054)) for name in ('short','long')};samples.append(pair)
 if i<2:time.sleep(1.2)
 wait(lambda: queries('short.lab.test')==3 and queries('long.lab.test')==1)
 first=query('chain.lab.test.',port=1054);assert first.answer[0].ttl==6
 wait(lambda: queries('chain.lab.test')==1)
 time.sleep(2.2);cache(port=1055,upstream=1054)
 downstream=query('chain.lab.test.',port=1055);upstream=query('chain.lab.test.',port=1054)
 assert values(downstream)==['127.0.0.4'] and 0<downstream.answer[0].ttl<6
 assert abs(downstream.answer[0].ttl-upstream.answer[0].ttl)<=1
 assert queries('chain.lab.test')==1
 update('short 1 IN A 127.0.0.2\nlong 20 IN A 127.0.0.3\nchain 6 IN A 127.0.0.5')
 wait(lambda: values(query('chain.lab.test.',port=1055))==['127.0.0.5'],timeout=8)
 wait(lambda: queries('chain.lab.test')==2)
 print(json.dumps({'three_lookups_each':samples,'authority_query_counts':{'short':queries('short.lab.test'),'long':queries('long.lab.test')},
 'cache_chain':{'original':show(first),'downstream_first':show(downstream),'upstream_remaining':show(upstream),'authority_queries_after_expiry':queries('chain.lab.test')}},sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The short.lab.test record has TTL 1 and long.lab.test has TTL 20. The program queries each three times, waiting 1.2 seconds between rounds. The authoritative log records three queries for the short-lived record and one for the long-lived record. Both produce successful answers on every round. The difference is upstream work under this controlled request schedule, not a measured application-latency improvement.

The returned TTL for the long-lived record decreases across rounds, while each refreshed short-lived answer starts at 1 again. The script checks the server log rather than assuming a fast response means a cache hit. On loopback, even an uncached query can be quick, so response time alone would not establish whether the authority was contacted or the answer came from memory.

For the layered case, the first forwarder caches chain.lab.test with TTL 6. After 2.2 seconds, a newly started second forwarder queries through it. The recorded downstream answer has TTL 3, matching the upstream remaining value within integer-second timing. It does not regain TTL 6. The authoritative count remains one, confirming that this downstream fill reused the first forwarder’s cached answer.

The authority then changes the chain record’s address. Queries through the second forwarder eventually receive the new address, and the authoritative count rises to two. This checks successful refresh through both layers after the retained data expires. The exact expiry fraction is implementation-dependent; the asserted properties are preserved remaining lifetime, no premature extra authoritative query, and eventual acquisition of the changed value.

Choose TTL from observed demand and change needs

Use expected change frequency and acceptable old-answer overlap alongside query volume. A busy shared resolver can amortize one answer across many clients, whereas isolated caches duplicate fills. Eviction can make an entry disappear before its TTL, so a long configured lifetime does not guarantee a hit. Measure hits, misses, upstream requests, and available capacity instead of treating TTL as a cache-size control.

For a planned move, lower TTL early enough for earlier longer-lived copies to expire. Keep the destination overlap aligned with the actual retained data. Raising TTL after stability reduces repeated resolution for busy records, but it also extends the next change’s ordinary waiting window. The relevant unit is the RRset: records of the same name, class, and type should have a consistent TTL.

Finally, compare answer data and remaining lifetime at each resolver actually used by the application. A direct authoritative query and a cached recursive answer reveal different states. Application caches and existing connections may add their own behavior outside this DNS experiment. Separate those lifetimes before estimating how quickly users will discover a changed endpoint or how much authoritative capacity a TTL adjustment requires.

Sources

RFC 1035 domain names, TTL as a cache lifetime and treatment of cached records, checked 2026-09-12.
RFC 2181 DNS clarifications, TTL limits and consistent lifetime within an RRset, checked 2026-09-12.
dnsmasq manual, cache sizing, forwarding, and TTL options, checked 2026-09-12.

Redis TTL lets every key carry its own clock

Tue, 29 Jun 2027 00:00:00 +0000

Redis expiration answers when a key should stop being available, not how much memory the server may consume. A deadline belongs to the key, and later commands can preserve, replace, or remove it. Reliable TTL use therefore requires testing update paths as well as the initial insertion. A successful write alone says nothing about the deadline remaining afterward.

A deadline is not a sliding timer

EXPIRE accepts seconds; PEXPIRE accepts milliseconds. Redis stores expiration as an absolute Unix timestamp, so elapsed time does not pause while the server is stopped. Stable system clocks matter, especially when restoring data on another machine. This is not a monotonic-duration promise independent of wall-clock changes. The exercise never changes the system clock.

GET does not refresh expiration. In-place changes such as INCR preserve the key’s existing timeout, whereas an ordinary successful SET replaces the value and discards the old timeout. SET with KEEPTTL preserves it. Explicitly issuing another expiration command changes the deadline again. Applications wanting sliding sessions must deliberately implement that policy rather than assuming each read extends access.

Set the value and its initial lifetime together with SET EX or SET PX when both belong to one operation. Separate SET and EXPIRE calls leave a failure window in which the value exists without expiration. A client crash between them can create a persistent entry. This is a write-protocol defect, not a slow expiration cycle.

Inspect the actual state

TTL returns remaining seconds, with -1 for an existing key without expiration and -2 for a missing key. PTTL offers millisecond resolution. PEXPIRETIME reports the absolute deadline, which makes preserving a deadline easier to test than comparing two countdown values that legitimately decrease between commands. A TTL result is a snapshot, not a reservation that guarantees the key survives until then.

EXPIRE NX only adds a deadline when none exists. GT only accepts a later deadline; a persistent key is treated as having an infinite lifetime for that comparison. PERSIST explicitly removes expiration. Check these commands’ results rather than treating every accepted command as a successful state change. A non-positive relative expiry deletes the key immediately; it is not another spelling of persistence.

When it breaks

Passive expiration checks deadlines during access, while active expiration removes expired keys that are not accessed. Delayed physical cleanup is not permission for an ordinary primary GET to keep serving an expired value. Nor does removing an entry guarantee that its allocator pages immediately return to the operating system. Visibility, data-structure cleanup, and process RSS are different observations.

A TTL is not a hard memory budget. Arrival rate, value sizes, unexpired data, command overhead, and allocator behavior still determine consumption. Eviction can also remove a key before its deadline. Do not use cache presence as the only business authorization check, or infer replication and failover guarantees from a single-instance experiment. Define the relevant deadline and consistency boundary for those workflows separately.

Check it quickly

Use a POSIX environment with a C compiler, make, curl, tar, and Python 3.10 or newer. This ran on macOS with Python 3.14.4, Redis 8.10.1, and redis-py 8.1.0. These commands build Redis core using libc and install only the client into a temporary virtual environment. Nothing is installed system-wide; optional bundled modules are not built.

redis_lab=$(mktemp -d)
curl --fail --location --output "$redis_lab/redis.tar.gz" https://download.redis.io/releases/redis-8.10.1.tar.gz
tar -xzf "$redis_lab/redis.tar.gz" -C "$redis_lab"
make -C "$redis_lab/redis-8.10.1" build redis -j2 MALLOC=libc
export REDIS_SERVER="$redis_lab/redis-8.10.1/src/redis-server"
python3 -m venv "$redis_lab/venv"
"$redis_lab/venv/bin/python" -m pip install redis==8.1.0

Run the Python block with "$redis_lab/venv/bin/python" in the same shell. It starts a disposable Redis over a private Unix socket beneath /tmp, with TCP, snapshot scheduling, and append-only persistence disabled. Requests cannot reach a default localhost Redis. The program terminates its own process and removes only its temporary runtime directory. Downloads require network access; the experiment does not.

from contextlib import contextmanager
import os
from pathlib import Path
import subprocess
from tempfile import TemporaryDirectory
import time

import redis
from redis.backoff import NoBackoff
from redis.retry import Retry


@contextmanager
def instance(policy="noeviction"):
 with TemporaryDirectory(prefix="redis-lab-", dir="/tmp") as directory:
 endpoint = str(Path(directory) / "redis.sock")
 process = subprocess.Popen([
 os.environ["REDIS_SERVER"], "--port", "0",
 "--unixsocket", endpoint, "--unixsocketperm", "700",
 "--save", "", "--appendonly", "no", "--dir", directory,
 "--maxmemory-policy", policy,
 ], stdout=subprocess.DEVNULL, stderr=subprocess.PIPE)
 client = redis.Redis(unix_socket_path=endpoint, decode_responses=True,
 socket_timeout=2, retry=Retry(NoBackoff(), 0))
 try:
 deadline = time.monotonic() + 5
 while True:
 assert process.poll() is None, "Redis exited during startup"
 try:
 if client.ping():
 break
 except redis.ConnectionError:
 if time.monotonic() >= deadline:
 raise
 time.sleep(0.02)
 yield client
 finally:
 client.close()
 if process.poll() is None:
 process.terminate()
 try:
 _, errors = process.communicate(timeout=5)
 except subprocess.TimeoutExpired:
 process.kill()
 process.communicate()
 raise
 assert process.returncode == 0, errors.decode()


with instance() as client:
 assert client.ttl("missing") == -2
 client.set("session", "A", px=60000)
 deadline = client.pexpiretime("session")
 assert client.get("session") == "A"
 assert client.pexpiretime("session") == deadline
 client.set("session", "B", keepttl=True)
 assert client.pexpiretime("session") == deadline
 print("GET and SET KEEPTTL preserve the absolute deadline")

 client.set("session", "C")
 assert client.ttl("session") == -1
 assert client.expire("session", 60, nx=True)
 assert not client.expire("session", 120, nx=True)
 assert client.expire("session", 120, gt=True)
 assert not client.expire("session", 30, gt=True)
 assert client.persist("session")
 assert client.ttl("session") == -1
 print("plain SET clears TTL; NX, GT and PERSIST follow their conditions")

 client.set("counter", "1", px=60000)
 deadline = client.pexpiretime("counter")
 assert client.incr("counter") == 2
 assert client.pexpiretime("counter") == deadline
 assert client.expire("counter", 0)
 assert client.get("counter") is None
 print("INCR preserves TTL; EXPIRE zero deletes immediately")

 client.pexpire("session", 100)
 limit = time.monotonic() + 3
 while client.get("session") is not None:
 assert time.monotonic() < limit, "key did not expire"
 time.sleep(0.01)
 assert client.ttl("session") == -2
 print("after expiry: GET is None and TTL is -2")

The absolute deadline survives GET and SET KEEPTTL, but plain SET leaves TTL -1. The conditional expiry assertions distinguish successful updates from rejected ones, and PERSIST returns the key to the persistent state. INCR retains its original deadline; EXPIRE zero removes that separate counter immediately.

Finally, a 100-millisecond timeout leads to GET returning None and TTL -2. A bounded polling loop observes actual disappearance without demanding an exact scheduler latency. These results verify command semantics and ordinary expired reads, not memory reclamation timing, active-cycle throughput, replication behavior, failover, or secure deletion of previously copied data.

Sources

Redis EXPIRE, deadline updates, conditional options, clocks, and active/passive expiration, checked 2026-09-08.
Redis SET, atomic value/lifetime assignment and KEEPTTL, checked 2026-09-08.
Redis TTL, remaining lifetime and the -1/-2 results, checked 2026-09-08.
Redis 8.10.1 build instructions, core-only compilation and allocator selection, checked 2026-09-08.

Negative DNS answers preserve absence until their cache lifetime expires

Thu, 22 Oct 2026 00:00:00 +0000

DNS can return useful information by saying that data is absent. NXDOMAIN reports a name error; NODATA describes a successful response without the requested record type. In a direct query without aliases, these distinguish a nonexistent name from an existing name that lacks the requested data. Caching those results avoids repeating the same unsuccessful upstream lookup for every client request.

When it breaks

A deployment can create a correct record and still appear broken to clients whose resolver previously cached its absence. The authority returns the new data, while the cache continues returning the earlier negative result until its lifetime ends. Repeatedly recreating the record does not invalidate that remote cache. This is especially visible when applications query a planned hostname before provisioning completes.

An empty answer section alone is not enough to classify a DNS result. Examine the response code, authority section, and any alias chain. A referral is different from an authoritative negative answer, and an NXDOMAIN can concern a terminal CNAME target rather than the originally requested alias. Reporting every empty result as “the domain does not exist” can send investigation toward the wrong record.

For authoritative NXDOMAIN and NODATA covered by RFC 2308, negative lifetime comes from the smaller of SOA.MINIMUM and the SOA record’s TTL. That value is carried on the SOA in the negative response and aged by caches. The MINIMUM field is not a universal floor for all positive record TTLs, and changing only a future positive record’s TTL does not shorten an already cached absence.

Check it quickly

Save this as check-negative-dns.py and run python3 check-negative-dns.py with Docker. The pinned environment uses BIND 9.18.49 and dnsmasq 2.90 on isolated loopback networking. The first zone has SOA TTL 8, SOA minimum 4, and one existing A record. The example checks actual responses and authoritative query counts before and after creating the missing data:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends bind9=1:9.18.49-1~deb12u2 bind9-dnsutils=1:9.18.49-1~deb12u2 dnsmasq-base=2.90-4~deb12u2 python3-dnspython=2.3.0-1 && rm -rf /var/lib/apt/lists/*\nCMD ["/usr/bin/python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,re,signal,subprocess,time
import dns.exception,dns.message,dns.query,dns.rcode,dns.rdatatype

def run(*args,check=True):
 result=subprocess.run(args,capture_output=True,text=True,timeout=15)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def query(name,kind='A',port=1053):
 return dns.query.udp(dns.message.make_query(name,kind),'127.0.0.1',port=port,timeout=1)
def values(response,kind='A'):
 wanted=dns.rdatatype.from_text(kind)
 return [item.to_text() for rrset in response.answer if rrset.rdtype==wanted for item in rrset]
def show(response):
 def section(records):return [{'name':str(rr.name),'type':dns.rdatatype.to_text(rr.rdtype),'ttl':rr.ttl,'data':[item.to_text() for item in rr]} for rr in records]
 return {'rcode':dns.rcode.to_text(response.rcode()),'answer':section(response.answer),'authority':section(response.authority)}
def wait(predicate,timeout=15):
 deadline=time.monotonic()+timeout
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except (OSError,dns.exception.Timeout):pass
 time.sleep(.05)
 raise AssertionError('DNS fixture condition did not become true')
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=5)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=5)

@contextmanager
def lab(records,soa_ttl=8,minimum=4,extra=''):
 with TemporaryDirectory(prefix='xbcatm-dns-') as directory,ExitStack() as stack:
 root=Path(directory);zone=root/'zone';conf=root/'named.conf';log=root/'named.log';serial=1
 def save(body):
 zone.write_text(f'$ORIGIN lab.test.\n$TTL 30\n@ {soa_ttl} IN SOA ns.lab.test. hostmaster.lab.test. ({serial} 60 60 3600 {minimum})\n@ IN NS ns.lab.test.\nns IN A 127.0.0.1\n'+body+'\n')
 run('named-checkzone','lab.test',str(zone))
 save(records)
 conf.write_text(f'''options {{ directory "{root}"; listen-on port 1053 {{127.0.0.1;}}; listen-on-v6 {{none;}};
recursion no; dnssec-validation no; notify no; querylog yes; max-cache-size 8m; pid-file "{root}/named.pid"; session-keyfile none;
{extra} }};
controls {{}};
zone "lab.test" {{ type primary; file "{zone}"; }};
''')
 run('named-checkconf',str(conf))
 output=stack.enter_context(log.open('w'))
 authority=subprocess.Popen(['named','-g','-c',str(conf),'-n','1','-U','1'],stdout=output,stderr=subprocess.STDOUT)
 stack.callback(stop,authority)
 def ready():
 assert authority.poll() is None,log.read_text()
 response=query('lab.test.','SOA');return response.rcode()==0 and response.answer[0][0].serial==serial
 wait(ready)
 def update(body):
 nonlocal serial
 serial+=1;save(body);authority.send_signal(signal.SIGHUP);wait(ready)
 def cache(port=1054,upstream=1053,size=150,options=()):
 logfile=root/('cache-'+str(port)+'.log');stream=stack.enter_context(logfile.open('w'))
 command=['dnsmasq','--no-daemon','--conf-file=/dev/null','--no-resolv','--no-hosts','--bind-interfaces',
 '--listen-address=127.0.0.1','--port='+str(port),'--server=127.0.0.1#'+str(upstream),
 '--cache-size='+str(size),'--log-queries','--log-facility=-',*options]
 process=subprocess.Popen(command,stdout=stream,stderr=subprocess.STDOUT);stack.callback(stop,process)
 def cache_ready():
 assert process.poll() is None,logfile.read_text()
 return query('lab.test.','SOA',port).rcode()==0
 wait(cache_ready);return process,logfile
 def queries(name,kind='A'):
 return sum(bool(re.search(r'query: '+re.escape(name.rstrip('.'))+r' IN '+kind+r'\b',line)) for line in log.read_text().splitlines())
 yield root,update,cache,queries
with lab('exists 30 IN A 127.0.0.2',soa_ttl=8,minimum=4) as (_,update,cache,queries):
 cache();missing=query('new.lab.test.',port=1054);nodata=query('exists.lab.test.','AAAA',1054)
 assert missing.rcode()==dns.rcode.NXDOMAIN and not missing.answer
 assert nodata.rcode()==dns.rcode.NOERROR and not nodata.answer
 for answer in (missing,nodata):assert len(answer.authority)==1 and answer.authority[0].rdtype==dns.rdatatype.SOA and answer.authority[0].ttl==4
 wait(lambda: queries('new.lab.test')==1 and queries('exists.lab.test','AAAA')==1)
 again=query('new.lab.test.',port=1054);again_nodata=query('exists.lab.test.','AAAA',1054)
 assert again.rcode()==dns.rcode.NXDOMAIN and again_nodata.rcode()==0 and not again_nodata.answer
 assert queries('new.lab.test')==1 and queries('exists.lab.test','AAAA')==1
 positive=query('exists.lab.test.','A',1054);assert values(positive)==['127.0.0.2']
 update('exists 30 IN A 127.0.0.2\nexists 30 IN AAAA ::1\nnew 30 IN A 127.0.0.3')
 assert values(query('new.lab.test.'))==['127.0.0.3'] and values(query('exists.lab.test.','AAAA'),'AAAA')==['::1']
 stale_missing=query('new.lab.test.',port=1054);stale_nodata=query('exists.lab.test.','AAAA',1054)
 assert stale_missing.rcode()==dns.rcode.NXDOMAIN and stale_nodata.rcode()==0 and not stale_nodata.answer
 wait(lambda: values(query('new.lab.test.',port=1054))==['127.0.0.3'],timeout=7)
 wait(lambda: values(query('exists.lab.test.','AAAA',1054),'AAAA')==['::1'],timeout=7)
 result={'NXDOMAIN':show(missing),'NODATA':show(nodata),'repeat_upstream_queries':{'NXDOMAIN':1,'NODATA':1},'existing_A_unaffected':show(positive),
 'immediately_after_creation':{'NXDOMAIN':show(stale_missing),'NODATA':show(stale_nodata)},'new_records_observed_after_expiry':True}
with lab('exists 30 IN A 127.0.0.2',soa_ttl=2,minimum=9) as (_,update,cache,queries):
 smaller=query('new.lab.test.');assert smaller.rcode()==dns.rcode.NXDOMAIN and smaller.authority[0].ttl==2
 result['smaller_SOA_TTL']=show(smaller)
print(json.dumps(result,sort_keys=True))
"""
name='xbcatm-dns-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 built=docker('build','-t',name,str(root));assert built.returncode==0,built.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--memory','384m','--pids-limit','128',name,
 '/usr/bin/python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

An A query for new.lab.test returns NXDOMAIN. An AAAA query for exists.lab.test, which already has A 127.0.0.2, returns NOERROR with no answer data. Both negative responses contain an SOA with TTL 4. The program repeats both queries through the cache and confirms that each has generated only one upstream query, proving reuse rather than merely observing two identical responses.

Querying the existing name’s A record still succeeds. This shows that the cached absence of AAAA does not mean every type at that name is absent. The script next adds A for the new name and AAAA for the existing name, reloads the authoritative zone, and verifies the new records directly. The authority now returns 127.0.0.3 and ::1, respectively.

Immediately querying through dnsmasq still returns the earlier NXDOMAIN and NODATA results. After the negative entries expire, those queries return the new positive data. A second isolated zone reverses the limiting values: SOA TTL 2 and minimum 9 produce a negative response with TTL 2. Together the cases verify both sides of the minimum rule instead of only one convenient configuration.

Separate authoritative absence from resolution failure

SERVFAIL, timeout, and DNSSEC validation failure do not establish that a name is absent. They describe failure to obtain or accept an answer. They are not categorically uncacheable, however: RFC 9520 updates the requirements for caching DNS resolution failures, including validation failures. Its failure-cache lifetime rules differ from the SOA-derived lifetime used for the authoritative negative answers in this experiment.

Do not assume a resolver implements every current recommendation merely because it caches NXDOMAIN correctly. This fixture does not test failure caching or DNSSEC validation. Inspect the deployed resolver’s version, configuration, and diagnostics for those behaviors. Preserve response codes and extended error information when available so a cached validation problem is not mistaken for a recently deleted hostname.

Before publishing a new service, consider whether its names have already been queried while absent. Create required records early when the deployment permits, and allow any known negative cache window to drain before requiring successful discovery. An operator can clear a cache they control, but cannot normally purge every independent resolver used by clients. Verify both authoritative publication and the affected resolver’s current response.

Choose negative lifetime with recovery and repeated-miss load in mind. Repeated queries for one absent name can benefit from caching; a stream of unique names behaves differently and still consumes resources. Keep positive and negative query metrics distinguishable. The operational question is which fact was cached, under which name and type, for how long, and what evidence now shows that the client’s view has changed.

Sources

RFC 2308 negative DNS caching, NXDOMAIN, NODATA, cache keys, and the SOA-derived lifetime, checked 2026-09-12.
RFC 9520 caching DNS resolution failures, updated requirements for resolution and validation failure caching, checked 2026-09-12.
dnsmasq manual, negative caching behavior and related options, checked 2026-09-12.

Ttl · XB Field Notes

DNS TTL trades repeated upstream queries against retained answers

When it breaks

Check it quickly

Choose TTL from observed demand and change needs

Sources

Redis TTL lets every key carry its own clock

A deadline is not a sliding timer

Inspect the actual state

When it breaks

Check it quickly

Further reading

Sources

Negative DNS answers preserve absence until their cache lifetime expires

When it breaks

Check it quickly

Separate authoritative absence from resolution failure

Sources